{"course":{"slug":"ai-for-small-business","title":"AI for a Small Business","url":"https://addaly.com/learn/ai-for-small-business","level":"beginner","track":"work"},"lesson":{"slug":"what-an-agent-actually-is","title":"What an agent is underneath, and why ten steps go wrong","url":"https://addaly.com/learn/ai-for-small-business/what-an-agent-actually-is","position":61,"of":88,"minutes":10,"answer":"An agent is a model in a loop that can call tools and decide when to stop, so its reliability is the per-step reliability raised to the number of steps.","keyIdea":"An agent is a model in a loop that can call tools and decide when to stop, so its reliability is the per-step reliability raised to the number of steps, which is why long autonomous chains fail far more often than each step suggests."},"body":{"format":"markdown","text":"## The actual mechanism\n\nStrip the marketing and an agent is a short loop:\n\n1. The model is given a goal and a list of tools it may use: search the web, read a file, look up a customer, send an email.\n2. It outputs either a final answer or a request to use one tool with particular arguments.\n3. Your software runs that tool and hands the result back.\n4. Repeat until it says it is finished, or until a limit stops it.\n\nThat is it. There is no planner, no memory of your business beyond what is in the context, and no understanding of consequence. The thing deciding which tool to call next is the same next-word predictor from module one, now predicting the text of a tool call.\n\nTwo consequences follow immediately, and they explain nearly everything about how agents behave.\n\n## Why step count is the whole story\n\nSuppose each step is right 95% of the time, which is generous for anything involving judgement.\n\nTwo steps: 0.95 × 0.95, about 90%. Five steps: about 77%. Ten steps: about 60%. Twenty steps: about 36%.\n\n> Figure: Why a ten-step run fails more often than its steps suggest. Line chart of chance the whole run is right (%) against steps in one run: Each step right 95 times in 100 (1, 95) (2, 90) (5, 77) (10, 60) (20, 36); Each step right 90 times in 100 (1, 90) (2, 81) (5, 59) (10, 35) (20, 12). Nothing degraded; the chain multiplies. Worse, a wrong result at step three enters the context and is read as established fact by every later step, which is why a failed run looks less like a stumble than like an articulate pursuit of the wrong objective.\n\nNothing degraded. Each individual step is still as good as it ever was. The chain multiplies, and a task needing twenty decisions fails more often than it succeeds even with excellent components.\n\nWorse, errors are not independent in a helpful direction. A wrong result at step three enters the context and is read as established fact by every later step, so the agent reasons confidently from it. This is why a failed agent run so often looks not like a stumble but like a sustained, articulate pursuit of the wrong objective.\n\n## What this means for what you should build\n\nShort chains. Three or four steps, each one checkable, with a person or a rule between the clusters.\n\nThe agent-shaped tasks that work in small businesses share a profile: a small number of steps, a bounded set of tools, cheap reversibility, and an obvious check at the end. Looking a customer's order up and drafting a reply about it. Reading an invoice, checking it against a purchase order, flagging the mismatch. Gathering five competitor prices into a sheet.\n\nThe ones that do not work share the opposite profile: open-ended goals, many tools, irreversible actions in the middle. \"Handle my inbox.\" \"Manage my supplier relationships.\" \"Run the shop's social media.\"\n\n## Limits you must set in the loop\n\nBecause the loop terminates only when the model decides to stop, you set the hard stops yourself:\n\n- **Maximum steps.** Ten is plenty. An agent that has taken ten steps is usually lost, not nearly there.\n- **Maximum spend per run**, following the previous lesson.\n- **A wall-clock timeout.**\n- **A list of tools it may call, and nothing else.** Especially: separate the tools that read from the tools that write.\n\n## The part vendors are quietest about\n\nAn agent that reads untrusted material and can also act is the vulnerability module two described, in its most exploitable form. A web page, a PDF, an email: anything it reads can contain text aimed at it, and the model has no reliable way to distinguish \"content I was asked to summarise\" from \"instructions I should follow\".\n\nFiltering does not solve this; it has not been solved. The only robust control is architectural: an agent that has read something untrusted must not also be able to send, pay, publish or delete. Keep reading and acting in different runs, with a person in between.\n\n## Where the field actually is\n\nHonestly: agents are improving quickly and are still unreliable for open-ended work. Benchmarks on multi-step office tasks show the best systems completing well under half of realistic jobs end to end, and small businesses do not get the carefully engineered conditions those numbers come from.\n\nMeanwhile the narrow version (a model, three tools, a person approving the result) works today and is cheap. If somebody demonstrates an agent running your business unattended, ask how many steps a typical run takes and what happens on the run where step four is wrong. The answer to the second question is the product.\n\n## A reasonable first agent\n\nTake something you already do at rung two. Give the model read-only access to the one system that holds the answer. Let it fetch and draft. You approve.\n\nThat is an agent. It is two steps. It will work most days, and the days it does not, you will see it before the customer does."},"check":{"question":"A consultant builds an agent to research a prospect: it searches the web, opens the three best pages, pulls facts into a brief, then drafts and sends a personalised email. Which change most reduces the risk, and why?","options":[{"text":"Restrict the searches to a list of approved domains, so the pages it reads are from sources the consultant already trusts.","correct":false,"tempting":"Reduces exposure but leaves the structure intact: one compromised or simply mistaken approved page still reaches a tool that sends."},{"text":"Lower the step limit to four, so the agent cannot wander through a long chain and accumulate errors before it reaches the drafting stage.","correct":false,"tempting":"A sensible limit that addresses compounding, while leaving the read-then-send path that turns any single bad read into an action."},{"text":"Remove the send tool, so the run ends with a draft the consultant approves.","correct":true},{"text":"Have a second agent review the drafted email against the source pages before it is sent, so an independent check catches fabricated or hostile content.","correct":false,"tempting":"Adds a reviewer that reads the same hostile text and is subject to the same weakness, which is why review by another model is not a containment boundary."}]},"prev":{"slug":"what-a-call-costs","title":"What a call costs, and how a loop becomes a bill","url":"https://addaly.com/learn/ai-for-small-business/what-a-call-costs"},"next":{"slug":"blast-radius","title":"Blast radius: what one confused run can reach","url":"https://addaly.com/learn/ai-for-small-business/blast-radius"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What an agent is underneath, and why ten steps go wrong', in AI for a Small Business. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-for-small-business/what-an-agent-actually-is (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What an agent is underneath, and why ten steps go wrong","courseTitle":"AI for a Small Business","module":{"index":7,"slug":"letting-it-act","title":"Letting it act: automation you can trust with the keys"},"answer":null,"keyIdea":"An agent is a model in a loop that can call tools and decide when to stop, so its reliability is the per-step reliability raised to the number of steps, which is why long autonomous chains fail far more often than each step suggests.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"line","title":"Why a ten-step run fails more often than its steps suggest","series":[{"label":"Each step right 95 times in 100","points":[[1,95],[2,90],[5,77],[10,60],[20,36]]},{"label":"Each step right 90 times in 100","points":[[1,90],[2,81],[5,59],[10,35],[20,12]]}],"xLabel":"steps in one run","yLabel":"chance the whole run is right (%)","caption":"Nothing degraded; the chain multiplies. Worse, a wrong result at step three enters the context and is read as established fact by every later step, which is why a failed run looks less like a stumble than like an articulate pursuit of the wrong objective."},"alt":"Figure: Why a ten-step run fails more often than its steps suggest. Line chart of chance the whole run is right (%) against steps in one run: Each step right 95 times in 100 (1, 95) (2, 90) (5, 77) (10, 60) (20, 36); Each step right 90 times in 100 (1, 90) (2, 81) (5, 59) (10, 35) (20, 12). Nothing degraded; the chain multiplies. Worse, a wrong result at step three enters the context and is read as established fact by every later step, which is why a failed run looks less like a stumble than like an articulate pursuit of the wrong objective."}},"blocks":[{"t":"h2","id":"the-actual-mechanism","runs":[{"text":"The actual mechanism"}]},{"t":"p","runs":[{"text":"Strip the marketing and an agent is a short loop:"}]},{"t":"ol","start":1,"items":[[{"text":"The model is given a goal and a list of tools it may use: search the web, read a file, look up a customer, send an email."}],[{"text":"It outputs either a final answer or a request to use one tool with particular arguments."}],[{"text":"Your software runs that tool and hands the result back."}],[{"text":"Repeat until it says it is finished, or until a limit stops it."}]]},{"t":"p","runs":[{"text":"That is it. There is no planner, no memory of your business beyond what is in the context, and no understanding of consequence. The thing deciding which tool to call next is the same next-word predictor from module one, now predicting the text of a tool call."}]},{"t":"p","runs":[{"text":"Two consequences follow immediately, and they explain nearly everything about how agents behave."}]},{"t":"h2","id":"why-step-count-is-the-whole-story","runs":[{"text":"Why step count is the whole story"}]},{"t":"p","runs":[{"text":"Suppose each step is right 95% of the time, which is generous for anything involving judgement."}]},{"t":"p","runs":[{"text":"Two steps: 0.95 × 0.95, about 90%. Five steps: about 77%. Ten steps: about 60%. Twenty steps: about 36%."}]},{"t":"p","runs":[{"text":"Nothing degraded. Each individual step is still as good as it ever was. The chain multiplies, and a task needing twenty decisions fails more often than it succeeds even with excellent components."}]},{"t":"p","runs":[{"text":"Worse, errors are not independent in a helpful direction. A wrong result at step three enters the context and is read as established fact by every later step, so the agent reasons confidently from it. This is why a failed agent run so often looks not like a stumble but like a sustained, articulate pursuit of the wrong objective."}]},{"t":"h2","id":"what-this-means-for-what-you-should-build","runs":[{"text":"What this means for what you should build"}]},{"t":"p","runs":[{"text":"Short chains. Three or four steps, each one checkable, with a person or a rule between the clusters."}]},{"t":"p","runs":[{"text":"The agent-shaped tasks that work in small businesses share a profile: a small number of steps, a bounded set of tools, cheap reversibility, and an obvious check at the end. Looking a customer’s order up and drafting a reply about it. Reading an invoice, checking it against a purchase order, flagging the mismatch. Gathering five competitor prices into a sheet."}]},{"t":"p","runs":[{"text":"The ones that do not work share the opposite profile: open-ended goals, many tools, irreversible actions in the middle. “Handle my inbox.” “Manage my supplier relationships.” “Run the shop’s social media.”"}]},{"t":"h2","id":"limits-you-must-set-in-the-loop","runs":[{"text":"Limits you must set in the loop"}]},{"t":"p","runs":[{"text":"Because the loop terminates only when the model decides to stop, you set the hard stops yourself:"}]},{"t":"ul","items":[[{"text":"Maximum steps.","b":true},{"text":" Ten is plenty. An agent that has taken ten steps is usually lost, not nearly there."}],[{"text":"Maximum spend per run","b":true},{"text":", following the previous lesson."}],[{"text":"A wall-clock timeout.","b":true}],[{"text":"A list of tools it may call, and nothing else.","b":true},{"text":" Especially: separate the tools that read from the tools that write."}]]},{"t":"h2","id":"the-part-vendors-are-quietest-about","runs":[{"text":"The part vendors are quietest about"}]},{"t":"p","runs":[{"text":"An agent that reads untrusted material and can also act is the vulnerability module two described, in its most exploitable form. A web page, a PDF, an email: anything it reads can contain text aimed at it, and the model has no reliable way to distinguish “content I was asked to summarise” from “instructions I should follow”."}]},{"t":"p","runs":[{"text":"Filtering does not solve this; it has not been solved. The only robust control is architectural: an agent that has read something untrusted must not also be able to send, pay, publish or delete. Keep reading and acting in different runs, with a person in between."}]},{"t":"h2","id":"where-the-field-actually-is","runs":[{"text":"Where the field actually is"}]},{"t":"p","runs":[{"text":"Honestly: agents are improving quickly and are still unreliable for open-ended work. Benchmarks on multi-step office tasks show the best systems completing well under half of realistic jobs end to end, and small businesses do not get the carefully engineered conditions those numbers come from."}]},{"t":"p","runs":[{"text":"Meanwhile the narrow version (a model, three tools, a person approving the result) works today and is cheap. If somebody demonstrates an agent running your business unattended, ask how many steps a typical run takes and what happens on the run where step four is wrong. The answer to the second question is the product."}]},{"t":"h2","id":"a-reasonable-first-agent","runs":[{"text":"A reasonable first agent"}]},{"t":"p","runs":[{"text":"Take something you already do at rung two. Give the model read-only access to the one system that holds the answer. Let it fetch and draft. You approve."}]},{"t":"p","runs":[{"text":"That is an agent. It is two steps. It will work most days, and the days it does not, you will see it before the customer does."}]}],"check":{"question":[{"text":"A consultant builds an agent to research a prospect: it searches the web, opens the three best pages, pulls facts into a brief, then drafts and sends a personalised email. Which change most reduces the risk, and why?"}],"options":[{"text":[{"text":"Restrict the searches to a list of approved domains, so the pages it reads are from sources the consultant already trusts."}],"correct":false,"tempting":[{"text":"Reduces exposure but leaves the structure intact: one compromised or simply mistaken approved page still reaches a tool that sends."}]},{"text":[{"text":"Lower the step limit to four, so the agent cannot wander through a long chain and accumulate errors before it reaches the drafting stage."}],"correct":false,"tempting":[{"text":"A sensible limit that addresses compounding, while leaving the read-then-send path that turns any single bad read into an action."}]},{"text":[{"text":"Remove the send tool, so the run ends with a draft the consultant approves."}],"correct":true,"tempting":null},{"text":[{"text":"Have a second agent review the drafted email against the source pages before it is sent, so an independent check catches fabricated or hostile content."}],"correct":false,"tempting":[{"text":"Adds a reviewer that reads the same hostile text and is subject to the same weakness, which is why review by another model is not a containment boundary."}]}],"order":[1,3,0,2],"why":null},"prev":{"slug":"what-a-call-costs","title":"What a call costs, and how a loop becomes a bill","minutes":9},"next":{"slug":"blast-radius","title":"Blast radius: what one confused run can reach","minutes":9}}}